Privacy Policy

Transparency and integrity are two unalterable values for EQX Equation Experience, reflected in the objective of acting responsibly in the community in which it is inserted and in the relationships with its clients, namely in the treatment and protection of the privacy of personal data provided to it within the scope of its commercial relationships.

In this way, the personal data received is processed based on the following principles:

• The processing of personal data is carried out lawfully, fairly and transparently;
• Personal data is collected only for specified, explicit and legitimate purposes, in accordance with the applicable legislation;
• The data collected is limited to what is strictly indispensable and for the time necessary for the purposes for which they are processed;
• Only EQX Equation Experience employees, collaborators and partners whose functions so require have access to the personal data processed;
• Personal data shall be treated confidentially.

PERSONAL DATA

In accordance with the provisions of the data protection legislation, personal data is any information relating to an identified or identifiable natural person (the data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, electronic identifiers, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

CONTROLLER

The controller of the personal data will be EQX Equation Experience.

CONDITIONS FOR PROCESSING

EQX Equation Experience shall only proceed with the processing of personal data in case one of the conditions laid down in the data protection legislation is met, namely:

• The data subject has given his/her consent to the processing of his/her personal data;
• The processing of the personal data is necessary for the performance of a contract to which the data subject is party, or for pre-contractual steps at the request of the data subject;
• The processing is necessary for compliance with a legal obligation to which EQX Equation Experience is subject;
• The processing is necessary to ensure legitimate interests of EQX Equation Experience.

TERM OF CONSERVATION OF PERSONAL DATA

In line with the aforementioned principles, the personal data processed by EQX Equation Experience are kept for the time strictly necessary for the purposes for which they were collected. The determination of these periods is made based on information retention criteria defined and adequate to each treatment and respecting the legal and regulatory obligations defined by law.

RIGHTS OF THE HOLDERS OF PERSONAL DATA

EQX Equation Experience ensures that the data subject can exercise the rights conferred on them by data protection legislation, namely:

• Right of access to personal data (the personal data subject may obtain confirmation as to whether their personal data are processed and access information about them);
• Right of rectification (the personal data subject may request that their personal data are rectified or that they are completed);
• Right to erasure (the data subject may request that their personal data be erased in certain situations:
  1. if the personal data are no longer necessary for the purpose for which they were collected or processed;
  2. if the data subject withdraws the consent on which the data processing is based and there is no other legal basis for the processing;
  3. if the data subject objects to the processing and there are no overriding legitimate interests;
  4. if the personal data have been unlawfully processed;
  5. if the personal data must be erased pursuant to a legal obligation, or
  6. if the personal data have been collected in connection with the provision of information society services);
• Right to restriction of processing (the personal data subject has the right to request restriction of processing where:
  1. contests its accuracy and for a period of time to allow its accuracy to be verified;
  2. considers that the processing is unlawful;
  3. if the data are no longer necessary for the purpose of the processing, but are required for the establishment, exercise or defence of legal claims, or
  4. if the data subject has objected to the processing and there is no overriding legitimate interest);
• Right to data portability (where processing is based on consent or in the performance of a contract and is carried out by automated means, the personal data subject may request the delivery, in a structured, commonly used and machine-readable format, of the personal data concerning him/her which he/she has provided, and may also request that the personal data be transmitted to another controller, provided that this is technically possible);
• Right to object (the data subject has the right to object to the processing at any time where:
  1. the processing is based on the legitimate interest of the person responsible for the processing or
  2. processing is carried out for purposes other than those for which the data were collected);
• Right not to be subject to automated individual decisions only (in certain situations, the personal data subject has the right to request human intervention when decisions are taken on the basis of automated processing only);
• Right to withdraw consent (the data subject has the right to withdraw the consent he or she has given for the processing of his or her personal data);
• Right to complain before the National Commission for Data Protection (on any matters related to the processing of their personal data).

SECURITY MEASURES

EQX Equation Experience has at its disposal technical and organisational security measures to ensure the protection of personal data against personal data breaches (“personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed) and against any other form of unlawful processing.

The commitment undertaken in the protection of personal data also implies that, whenever personal data is transmitted to other entities, these are obliged to adopt technical and organisational measures to ensure the same level of protection.

COMMUNICATION OF PERSONAL DATA TO OTHER ENTITIES

In the course of its activity, EQX Equation Experience may have to communicate or give access to your personal data to other entities, always ensuring that they present technical and organizational measures to adequately protect personal data.

Personal data will only be accessed by or shared with the following entities:

• Entities providing services to EQX Equation Experience, regarding for example IT support, document management, legal support, human resources;
• Clients of EQX Equation Experience;
• Public authorities (e.g. Tax and Customs Authority).

ADDITIONAL INFORMATION

This privacy policy may be subject to change at any time. In this case, changes will be duly announced and disclosed on the respective website.

WHISTLEBLOWING CHANNEL

Whenever the Whistleblower does not wish to remain anonymous, his/her identity shall only be known to those strictly necessary for processing the specific case, and the personal data shall be processed as described herein.

The Person Responsible for Treatment may, in compliance with the legal time limits, keep the personal data
personal data collected in the context of sharing the complaint in the various channels made available by the Controller, namely through the complaint collection form on the internet, email, telephone, letter, among others, the management of these means being the sole responsibility of the Controller, unless such service is outsourced to a third party.

Only the personal data that are relevant to the treatment of the complaint will be collected, while the rest will be deleted.
Categories of personal data collected may include:

• Identification data;
• Contact data;
• Data related to the complainant;
• Data related to the complaint.

The Controller may also collect personal information about you from public sources or through associated companies where legally possible. In such a case, the Controller will indicate the origin of the personal data.

The Controller will only use the personal information collected for the following purposes:

• To contact you (via e-mail, post, telephone, or any other legitimate means of contact);
• To verify your identity, where applicable;
• To complete information relevant to the progress of the investigation process;
• To ask questions related to the complaint;
• Provide you with the status of the investigation process;
• Processing and managing the complaint;
• Exercising legal rights.

The processing of personal data is carried out under and in compliance with the legal obligations set out in Law No. 93/2021, of 20 December, which establishes the mandatory creation of reporting channels, as well as the legitimate interest of the Person Responsible for Treatment in preventing and/or repressing irregularities covered therein.

The personal data collected in the context of the complaint submitted will be kept for at least 5 years, and this period may be extended if necessary to fulfil the purpose for which they were collected. Furthermore, personal data will be kept for the duration of any legal or administrative proceedings relating to the complaint submitted.

• The Controller does not disclose or provide access to personal information to third parties except in connection with the following purposes:
• The Controller may disclose any information necessary to comply
  with necessary legal obligations, in particular in the context of any investigations carried out by Public Authorities following complaints submitted;
• The Controller may contract with service providers to, for example, ensure the effective collection, screening and management of complaints, to carry out the investigation process, or otherwise.

Where your personal data is disclosed to third parties, all necessary steps will be taken to ensure that those third parties protect your personal information in accordance with this Privacy Policy and all applicable laws.

In accordance with applicable data protection legislation, the data subject has the right to:

• Request access to your personal data: You have the right to obtain confirmation as to whether or not any personal data concerning you is, or is not, being processed and, if so, to request access to your personal data. The access information includes, among others, the purposes of the processing, the categories of personal data concerned and the categories of recipients or the recipients to whom your personal data have been or will be disclosed.
  You may have the right to obtain a copy of the personal data being processed.
• Request the rectification of your personal data: you have the right to obtain the rectification of inaccuracies concerning your personal data. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of an additional declaration.
• Request the erasure of your personal data: in certain circumstances, you may have the right to obtain the erasure of your personal data and we may be obliged to erase such personal data.
• Requesting the restriction of the processing of your personal data: in certain circumstances, you may have the right to obtain the restriction of the processing of your personal data. In that case, your data will be marked and may only be processed by us with your consent or for certain purposes.
• Request data portability: in certain circumstances, you may have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format and you may have the right to transmit such data to another entity without our being able to prevent this.
• Oppose the processing of your personal data:
  The data subject has the right, for reasons relating to his or her particular situation and at any time, to object to the processing of his or her personal data. In such a case, the Controller will stop the processing of your personal data, unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

As a data subject, you also have the right to lodge a complaint with the competent data protection supervisory authority.

If you wish to exercise any of the aforementioned rights or wish to clarify any questions regarding the protection of privacy and personal data by EQX Equation Experience, you can do so by writing to or emailing us at the contact details provided in the “contact persons” section of this website.